Re: DoS "Probing" on one of our hosts

From: Edward Balas <ebalas(at)iu.edu>
Date: Mon Jun 30 2003 - 10:37:03 EDT

On Sun, 29 Jun 2003, Christopher Kunz wrote:

> Hey,
>
> we have been encountering three short DoS attacks during the weekend -

> 1. isn't one hour a pretty short time for a DoS? I've seen attacks on

Depends on the nature of the attack, from what I have seen this is not uncommen. Ive seen this type agaist IRC servers quite often.

> 2. is there any tool to determine the source IPs of the attack (even if

If you have access to the netflow accounting data for the routers, then you can backtrace the traffic to the incomming network. Or if you dont, your ISP may. They probably wont be interesting in helping backtrack this given the short duration.

Edward Balas  

> Regards,
>
> --ck
>

---

Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com

---

Received on Mon Jun 30 11:19:42 2003